vector miscompile from AArch64 backend

[regehr]

here's a function:

define i32 @f(<4 x i32> %0) {
  %2 = icmp ule <4 x i32> %0, zeroinitializer
  %3 = sext <4 x i1> %2 to <4 x i32>
  %4 = icmp sge <4 x i32> zeroinitializer, %3
  %5 = extractelement <4 x i1> %4, i32 0
  %6 = sext i1 %5 to i32
  ret i32 %6
}

if we pass <4 x i32><i32 0, i32 3, i32 3, i32 3> as an argument, it should return -1.
but the AArch64 backend gives:

_f:                        
	fmov	w8, s0
	cmp	w8, #0
	cset	w8, eq
	cmp	w8, #1
	csetm	w0, lt
	ret

which returns 0 for this input.
cc @nunoplopes

[llvmbot]

@llvm/issue-subscribers-backend-aarch64

Author: John Regehr (regehr)

here's a function: ```llvm define i32 @f(<4 x i32> %0) { %2 = icmp ule <4 x i32> %0, zeroinitializer %3 = sext <4 x i1> %2 to <4 x i32> %4 = icmp sge <4 x i32> zeroinitializer, %3 %5 = extractelement <4 x i1> %4, i32 0 %6 = sext i1 %5 to i32 ret i32 %6 } ``` if we pass `<4 x i32><i32 0, i32 3, i32 3, i32 3>` as an argument, it should return -1. but the AArch64 backend gives: ``` _f: fmov w8, s0 cmp w8, #0 cset w8, eq cmp w8, #1 csetm w0, lt ret ``` which returns 0 for this input. cc @nunoplopes

[davemgreen]

This probably started with #118823.

@david-arm FYI. I think we might be optimizing v4i32 sext(v4i1 setcc) to v4i32 setcc as we know vectors are ZeroOrNegativeOneBooleanContent. We then scalarize without considering that scalars are ZeroOrOneBooleanContent and we need to reinsert a sext_inreg.

[davemgreen]

@david-arm we should look into fixing this or revert the offending patch. Thanks

[david-arm]

Sorry I didn't see this sooner - for some reason I didn't get a notification! Taking a look now...

[david-arm]

I have a fix for this and I'll post upstream soon!